Network Monitor not running/Http proxy not running.

Hi Goldy_01 

When did you notice the service restarts? Did you upgrade to v9.504 recently?

Could you ssh into your firewall, check for coredumps & copy/paste output:

cd /var/storage/cores

ls -lha

Could you also check your kernel logs for segfaults & again post output:

cd /var/logs

grep segfault kernel.log

Thanks,
Karlos

I am also getting these. 

From /var/log/kernel.log

2017:10:26-09:39:25 hq-2 kernel: [430081.449948] nwd[10899]: segfault at 8337cf0 ip 000000000804b2a8 sp 00000000ffd5f690 error 4 in nwd[8048000+5000]
2017:10:26-09:39:25 hq-1 kernel: [422870.137755] nwd[22823]: segfault at 9f71cf0 ip 000000000804b2a8 sp 00000000fff8aa20 error 4 in nwd[8048000+5000]
2017:10:26-09:39:25 hq-1 kernel: [422870.172800] nwd[22857]: segfault at 8bfd2f0 ip 000000000804b2a8 sp 00000000ffe702a0 error 4 in nwd[8048000+5000]
2017:10:26-09:41:44 hq-1 kernel: [423009.818358] nwd[23227]: segfault at 8135cf0 ip 000000000804b2a8 sp 00000000ffd22aa0 error 4 in nwd[8048000+5000]
2017:10:26-09:41:44 hq-1 kernel: [423009.852929] nwd[23261]: segfault at 9dfa2f0 ip 000000000804b2a8 sp 00000000ffe92950 error 4 in nwd[8048000+5000]
2017:10:26-09:41:49 hq-1 kernel: [423014.745358] nwd[23414]: segfault at 9f31cf0 ip 000000000804b2a8 sp 00000000fffcd190 error 4 in nwd[8048000+5000]
2017:10:26-09:41:54 hq-2 kernel: [430230.669353] nwd[11018]: segfault at 9cee4f0 ip 000000000804b2a8 sp 00000000ffb82a00 error 4 in nwd[8048000+5000]
2017:10:26-09:44:00 hq-1 kernel: [423144.914500] nwd[23610]: segfault at 84afcf0 ip 000000000804b2a8 sp 00000000ff92d700 error 4 in nwd[8048000+5000]
2017:10:26-09:44:00 hq-1 kernel: [423144.944115] nwd[23640]: segfault at 9f431f0 ip 000000000804b2a8 sp 00000000fffa1ff0 error 4 in nwd[8048000+5000]
2017:10:26-09:44:03 hq-2 kernel: [430359.636894] nwd[12111]: segfault at 991d4f0 ip 000000000804b2a8 sp 00000000ffdab7a0 error 4 in nwd[8048000+5000]
2017:10:26-09:44:10 hq-2 kernel: [430366.266146] nwd[12793]: segfault at 9fcfcf0 ip 000000000804b2a8 sp 00000000ffb87bf0 error 4 in nwd[8048000+5000]
2017:10:26-09:44:10 hq-1 kernel: [423154.982520] nwd[23805]: segfault at 95c8cf0 ip 000000000804b2a8 sp 00000000ffdb45c0 error 4 in nwd[8048000+5000]
2017:10:26-09:44:10 hq-2 kernel: [430366.320334] nwd[12823]: segfault at 880a1f0 ip 000000000804b2a8 sp 00000000ffc42e10 error 4 in nwd[8048000+5000]
2017:10:26-09:44:10 hq-1 kernel: [423155.018429] nwd[23843]: segfault at 8b1b3f0 ip 000000000804b2a8 sp 00000000fffeca40 error 4 in nwd[8048000+5000]
2017:10:26-09:44:45 hq-1 kernel: [423189.979526] nwd[24007]: segfault at 9202cf0 ip 000000000804b2a8 sp 00000000ffc6bde0 error 4 in nwd[8048000+5000]
2017:10:26-09:44:45 hq-1 kernel: [423190.006937] nwd[24037]: segfault at 97c31f0 ip 000000000804b2a8 sp 00000000fffdea20 error 4 in nwd[8048000+5000]
2017:10:26-09:44:50 hq-2 kernel: [430406.108867] nwd[12910]: segfault at 9acd4f0 ip 000000000804b2a8 sp 00000000ffd74a50 error 4 in nwd[8048000+5000]
2017:10:26-09:44:55 hq-2 kernel: [430411.294698] nwd[13305]: segfault at 86a8cf0 ip 000000000804b2a8 sp 00000000ff9555e0 error 4 in nwd[8048000+5000]
2017:10:26-09:44:55 hq-1 kernel: [423200.041187] nwd[24200]: segfault at 8792cf0 ip 000000000804b2a8 sp 00000000ffa2e830 error 4 in nwd[8048000+5000]
2017:10:26-09:44:55 hq-1 kernel: [423200.076238] nwd[24238]: segfault at 85303f0 ip 000000000804b2a8 sp 00000000ffa2e030 error 4 in nwd[8048000+5000]
2017:10:26-09:47:00 hq-1 kernel: [423324.891944] nwd[24696]: segfault at 9951cf0 ip 000000000804b2a8 sp 00000000ffb43710 error 4 in nwd[8048000+5000]
2017:10:26-09:47:00 hq-1 kernel: [423324.922861] nwd[24726]: segfault at 864e1f0 ip 000000000804b2a8 sp 00000000ff925b50 error 4 in nwd[8048000+5000]
2017:10:26-09:47:05 hq-1 kernel: [423330.204841] nwd[24920]: segfault at 9471cf0 ip 000000000804b2a8 sp 00000000ffcd1a30 error 4 in nwd[8048000+5000]
2017:10:26-09:47:05 hq-1 kernel: [423330.234988] nwd[24942]: segfault at 94e2ff0 ip 000000000804b2a8 sp 00000000fffc3ce0 error 4 in nwd[8048000+5000]
2017:10:26-09:47:05 hq-1 kernel: [423330.293025] nwd[24964]: segfault at 97b92f0 ip 000000000804b2a8 sp 00000000ffd31170 error 4 in nwd[8048000+5000]
2017:10:26-09:47:08 hq-2 kernel: [430544.000203] nwd[13347]: segfault at 91654f0 ip 000000000804b2a8 sp 00000000ffd38b80 error 4 in nwd[8048000+5000]
2017:10:26-09:48:55 hq-1 kernel: [423439.767829] nwd[25215]: segfault at 8274cf0 ip 000000000804b2a8 sp 00000000ffd44e50 error 4 in nwd[8048000+5000]
2017:10:26-09:48:55 hq-1 kernel: [423439.803825] nwd[25249]: segfault at 88572f0 ip 000000000804b2a8 sp 00000000ffc64d50 error 4 in nwd[8048000+5000]
2017:10:26-09:49:00 hq-1 kernel: [423444.908556] nwd[25399]: segfault at 8a55cf0 ip 000000000804b2a8 sp 00000000ff8dc750 error 4 in nwd[8048000+5000]
2017:10:26-09:49:00 hq-1 kernel: [423444.934917] nwd[25438]: segfault at 82fb3f0 ip 000000000804b2a8 sp 00000000ffcea0d0 error 4 in nwd[8048000+5000]
2017:10:26-09:49:05 hq-2 kernel: [430661.034381] nwd[14687]: segfault at 84864f0 ip 000000000804b2a8 sp 00000000ff918f90 error 4 in nwd[8048000+5000]

Also several core dupms for nwd in /var/storage/cores

Any fix?

Thanks,
Brad

Kernel.pdf

Kernel Log

Hi Brad,

Thanks for sending those over. It seems that you are affected by BUG-ID: NUTM-8341

Which firmware version are you currently on? Patch is set to be released on v9.505 

Thanks,
Karlos

Hi Goldy_01,

Thanks for sending over your Kernel logs, did you run the grep command I asked you to?

Also, please send over output of your coredumps.

Thanks,
Karlos

Current firmware version:   9.505-4

<M> mhgate:/var/storage/cores # ls -lha
total 5.2G
drwx------  2 root root 4.0K Oct 27 04:12 .
drwxr-xr-x 14 root root 4.0K Jun 14 04:01 ..
-rw-r--r--  1 root root 1.4G Oct 17 19:49 httpproxy.NAVLWorker_09.6061
-rw-r--r--  1 root root 1.2G Oct 27 04:06 httpproxy.NAVLWorker_24.13444
-rw-r--r--  1 root root 1.6G Oct 27 04:04 httpproxy.NAVLWorker_25.7943
-rw-r--r--  1 root root 1.2G Oct 27 04:12 httpproxy.NAVLWorker_30.13868
<M> mhgate:/var/storage/cores #

Hi, Brad, and welcome to the UTM Community!

Goldy - glad to have you back!

Guys, several people got a bad pattern in August.  A temporary fix was disabling Application Control until a new pattern became available.  Does that work here?

Cheers - Bob

Hi Bob :)

well, what fix are U taking about?

Thanks,

Goldy.

They disabled Application Control as a temporary workaround until Sophos fixed the pattern that was causing the problem.

Cheers - Bob